Windows, security, etc.

Today, Core Security Technologies issued Security Advisory regarding  Virtual PC Hypervisor Memory Protection Vulnerability.
Vulnerable systems are:

• Microsoft Virtual PC 2007,
• Microsoft Virtual PC 2007 SP1,
• Windows Virtual PC,
• Windows Server 2005 and
• Windows Server 2005 R2 SP1

Microsoft Hyper-V is NOT vulnerable.

Vulnerability is explained in this document. If you don’t want to read the whole article (I advise you to read it) here are some important parts of it:

• It’s only locally exploitable (remotely only if some other vulnerability exists that is remotely exploitable)
• There is no CVE at the moment
• It was discovered 7 months ago. Core Security worked with Microsoft to identify impact this may have before announcing it.
• It’s using memory above 2GB (memory reserved for system)
• It’s possible to bypass DEP (Data Execution Prevention), SafeSEH (Safe structured error handling) and ASLR (Address Space Layout Randomization)
• There is a PoC (proofe of concept) code available
• The vulnerable part of Virtual PC hypervisor is VMM (Virtual Machine Manager)